Legal
Privacy policy
The short version
- Cutfish helps brands plan, make and review short videos for TikTok and Instagram Reels. We use your information only to run the service for you.
- When you connect TikTok, we use that access to put videos in your drafts, post the first comment on your own videos, and read how your videos perform. We never post publicly without a person.
- When you connect Google Drive, we only read the video files in the folder you choose.
- We don't sell your information or use it for advertising. You can disconnect accounts and ask us to delete your data at any time.
1. Who we are
Cutfish ("Cutfish", "we", "us") is operated by [legal company name], [registered address]. This policy covers the Cutfish website and the Cutfish app (together, the "Service"). If you have questions, email partners@vygor.health.
Cutfish is a business tool. Our customers are brands and companies (each a "Customer"), and the people who use Cutfish on their behalf are "Users". For content and data that a Customer brings into Cutfish, the Customer decides how it is used, and we process it on the Customer's instructions.
2. What we collect
Information you give us
- Account information: name, work email, the company you belong to, and your role (owner, maker, reviewer or viewer). Passwords are stored only as salted hashes.
- Brand information: brand profiles, audience profiles, claims the brand can and cannot make, content plans, ideas, trend research, scripts, captions, hashtags, review notes and results you enter, such as weekly sign-ups.
- Website addresses you ask us to read. We fetch those public pages to draft your brand profile.
Information from TikTok, when you connect an account
A TikTok account owner can connect a TikTok account to Cutfish through TikTok's own authorization page, using TikTok API for Business. We never see or store your TikTok password. With the permissions you grant, we receive and use:
| Data | Why we use it |
|---|---|
| Basic account information: account ID, display name, username and profile image | To show which account is connected and send videos to the right account |
| Access and refresh tokens | To act for the account within the permissions you granted. Stored encrypted (AES-256-GCM) and never shown in the app |
| Video upload and publishing | To upload finished videos you approved to the account's TikTok drafts. The account owner reviews and posts them in TikTok |
| Your account's videos and their metrics (such as views, likes, comments and shares) | To match posted videos to your plan and show results, so you can see what worked |
| Comments on your own videos | To post the brand's first comment (for example, a link) on your own video after it is posted, and to manage that comment |
| Trend data, such as popular hashtags in your industry, where available | To inform your monthly content ideas. This is aggregate data, not personal information |
We use TikTok data only to provide the Service to the Customer that connected the account. We don't sell it, use it for advertising, or use it to build profiles of TikTok users. We read only the connected account's own videos and comments.
Information from Google, when you connect Google Drive
A User can connect Google Drive through Google's sign-in page and choose a folder of video clips. Cutfish has read-only access: it lists and downloads the video files in that folder so they can be matched to scripts and rendered. We never edit, move or delete your Drive files, and we don't read other files.
Cutfish's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Information collected automatically
- App: server logs (IP address, browser type, time and the request made) for security and troubleshooting, and a sign-in token stored in your browser's local storage to keep you signed in.
- Website: this website sets no cookies and uses no analytics or advertising trackers. It loads fonts from Google Fonts, which receives your IP address when fonts load.
3. How we use information
- To provide the Service: plan content, draft ideas and scripts, assemble and render videos, run reviews, send drafts to TikTok and show results.
- To keep each Customer's data separate and secure, and to prevent abuse.
- To support you and tell you about changes to the Service.
- To meet legal obligations.
We don't sell personal information and we don't use Customer content to advertise to anyone.
4. AI processing
Cutfish uses AI models from third-party AI model providers to draft brand profiles, ideas, scripts, claim reviews and video prompts. To do this, we send the provider the relevant text: for example your brand profile, the website text you asked us to read, or a script. The provider processes it to return a draft under commercial terms that don't permit training its models on this content. AI drafts are suggestions. A person on your team reviews and approves them before anything is posted.
Avatar videos are made with third-party AI video tools. They show synthetic presenters, not real people, and carry an "AI-generated" label.
5. Who we share information with
We share information only with service providers that help us run Cutfish, under contracts that limit their use of it, or when the law requires it.
| Provider | Purpose |
|---|---|
| AI model providers | Drafting brand profiles, ideas, scripts and reviews |
| AI video tools | Making avatar videos and clips |
| TikTok | Sending drafts, comments and reading results for accounts you connect |
| Reading clips from the Drive folder you choose; website fonts | |
| [App hosting provider, e.g. Amazon Web Services] | Hosting the app, database and files |
| Vercel | Hosting this website |
If Cutfish is involved in a merger or acquisition, information may transfer as part of it, and this policy will continue to apply.
6. How long we keep information
- TikTok and Google access: until you disconnect the account. Disconnecting deletes the stored tokens right away.
- Account and brand data: while the Customer's account is active. After an account closes, or when you ask us to delete data, we delete it within 30 days, except where the law requires us to keep it. Backups are overwritten within a further 30 days.
- Server logs: up to 90 days.
7. Disconnecting and deleting
- TikTok: disconnect in Cutfish under Connections, or revoke Cutfish's access in TikTok's settings for connected apps. Either way, Cutfish can no longer act on the account.
- Google Drive: disconnect in Cutfish under Connections, or remove Cutfish from your Google Account's third-party access page.
- Delete your data: email partners@vygor.health from your account's email address. We confirm within 7 days and complete deletion within 30.
8. Security
Data is encrypted in transit (TLS). Connected-account tokens are encrypted at rest. Each Customer's data is kept apart at the database level, access is limited by role, and sign-in attempts are rate-limited. No system is perfectly secure; if we learn of a breach affecting your information, we will tell you as the law requires.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal information, and to object to or restrict some processing. To use these rights, email partners@vygor.health. If your data came to us through a Customer (for example, your employer), we may refer your request to them. You can also complain to your local data protection authority.
10. Children
Cutfish is a business service for adults. It isn't directed to anyone under 18, and we don't knowingly collect children's information.
11. International transfers
We and our providers may process information in the United States and other countries. Where required, we use appropriate safeguards for these transfers.
12. Changes
We'll post any changes here and update the date above. If a change is significant, we'll tell Customers by email or in the app before it takes effect.
13. Contact
[legal company name], [registered address] · partners@vygor.health